CVE-2026-36848

CVE-2026-36848 A critical path traversal vulnerability was identified in the web-based management engine on port 8089 of Gigamon-VUE OS GVOS appliances. This flaw exists in the legacy H-VUE subsystem within the persistd daemon and allows an unauthenticated, remote attacker with network access to...

CVE-2024-57521-RuoYi-SQLi

🛡️ CVE-2024-57521 RuoYi-Vue Post-Authentication SQL Injection Vulnerability Audit Notes Figure 1: CVE-2024-57521 SQL Injection Vulnerability Data Flow Audit Diagram 0. Project Statement This repository is intended for security research and educational purposes only. Do not use the techniques in...

CVE-2024-6783

CVE-2024-6783 - Vue CVE A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript...

Gin-Vue-admin-poc-CVE-2022-21660

Gin-Vue-admin Vertical Privilege Escalation Vulnerability and Code Analysis - CVE-2022-21660 1. Foreword Welcome everyone to give this project a star.http https://github.com/flipped-aurora/gin-vue-admin/ After finishing the article, applying for a CVE was somewhat troublesome, but fortunately it...

CVE-2020-11883

CVE-2020-11883 vue-storefront-api vulnerability 🛠 Setup $ yarn instal $ tsnd . 🧨 Examples Message format $ tsnd . In this example, I tested the "Lights.ie" page. 🙀 Disclaimer This application is for testing purposes only, I am not responsible for any problems that may arise. Please test only wher...

Vue Vben Admin - Default Credentials

Vue Vben Admin 2.10.1 contains a broken authentication caused by hardcoded credentials in the backend, letting attackers log in without proper authorization, exploit requires access to the login interface. id: CVE-2025-25570 info: name: Vue Vben Admin - Default Credentials author: 0xAkoko severit...

pulsar

Pulsar What is it? Pulsar is an automated network footprint scanner for Red Teams, Pentesters and Bounty Hunters. Its focused on discovery of organization public facing assets with minimal knowledge about its infrastructure. Along with network data visualization, it attempts to give a basic...

CVE-2026-114492

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

CVE-2026-114492 gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

CVE-2026-114492

The gin-vue-admin framework (versions through 2.9.2 ) is vulnerable to a path traversal vulnerability in the /autoCode/removePlugin endpoint. An authenticated administrator can send a crafted POST request containing ../ sequences in the pluginName parameter, triggering the os.RemoveAll function. ...

CVE-2026-114492 gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

EUVD-2026-107420

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

Summary The client-side helper apos.http.parseQuery in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys proto, constructor, or prototype. Parsing an attacker-controlled query string therefore writes arbitrary properties onto Object.prototype client-side...

CLSA-2026-1792340315 TuxCare security update for @vue/compiler-sfc (1 CVE)

TuxCare rebuilt @vue/compiler-sfc to address 1 CVE. Fixed in 2.7.16-tuxcare.1...

EUVD-2026-98849

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses...

CVE-2026-110610

The ruoyi-vue-pro framework (versions through 2026.09 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the yudao-module-ai image service. Specifically, the midjourney imagine endpoint fails to properly validate the referImageUrl parameter. This allows authenticated users to fo...

CVE-2026-110610 ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...

EUVD-2026-101238

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...

CVE-2026-110610: Server-Side Request Forgery (SSRF)

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...

CVE-2026-110118

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...